Security
What is built today, and where the limits are.
Architecture
Static HTML, CSS and ES modules on Firebase Hosting — no server of ours. Firebase Authentication; Cloud Firestore and Cloud Storage. No Perpendis backend holds a session, a key or a copy of your prompts.
Authorization
- Access is decided by server-side security rules, not the browser: a direct database client meets the same rules as the console.
- Workspace data is authorized against the workspace document's member list; sub-collections never trust a field on the child.
- Only the owner changes membership. Members read and write systems, runs and packs, but cannot grant access.
- A completed run is write-once: sealed once, never edited, deletable only by the owner. Pack versions must be sequential, so none can be reused.
- A share can only be changed to revoke it; its evidence snapshot is immutable.
- Every rule has an automated positive and negative test, run against the Firebase emulators in CI.
Share links
256 bits of CSPRNG entropy, base64url-encoded. Readable without an account until revoked or
expired; revoked, expired and unknown tokens are refused identically. The reader sees the pack
snapshot and nothing else. Share pages are served noindex, nofollow.
Secrets
Perpendis stores no customer API keys, tokens or model weights, and has no field for them. Endpoint URLs are stored in the clear and shown to relying parties, so the console rejects any URL with credentials in its userinfo or in a secret-looking query parameter. On the in-VPC and on-prem deployments, only signed evidence artifacts leave your network.
Verification
The computational-integrity attestation is Ed25519 over canonical JSON, verified in the reader's own browser against the public key inside the receipt — trusting neither Perpendis nor the applicant. A valid signature is not a pass: it covers only the receipt's own fields. So each engine field is labelled by whether the signature covers it, and any stored value that disagrees with the receipt is flagged. Packs download as JSON, receipt included, for your own tooling.
Transport and browser hardening
- HTTPS only, with HSTS.
X-Content-Type-Options: nosniff,X-Frame-Options: DENY,Referrer-Policy: strict-origin-when-cross-origin; Permissions-Policy denies geolocation, microphone and camera.- A strict
Content-Security-Policywith no'unsafe-inline'inscript-src; the inline theme bootstrap is pinned by SHA-256 hash. - Uploads capped at 20 MB per file, restricted to pdf, txt, md, json, png, docx.
Known limits
- No SOC 2 or ISO 27001 report. We are early access.
- No formal penetration test. Our own adversarial work shows the referee catches the attacks we thought of — evidence, not a security proof.
- Nobody has formally relied on a Perpendis pack yet.
Reporting a vulnerability
Email platform@vbounds.com, subject line "security report": what you found, how to reproduce it, the impact. We acknowledge within 2 working days and say what we intend to do. Report in good faith — no privacy violations, no service degradation, reasonable time to fix before you go public — and we will not pursue you. There is no bounty programme today.